Package · Maven

org.apache.wss4j:wss4j-ws-security-dom

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

High 7.5

CVE-2015-0226

Use of a Broken or Risky Cryptographic Algorithm in Apache WSS4J

Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key or message data, which makes it easier for remote attackers to recover the plaintext form of a symmetric key via a series…

wss4j org.apache.ws.security:wss4j org.apache.wss4j:wss4j-ws-security-dom Debian Maven

Oct 30, 2017
Medium —

CVE-2014-3623

Improper Authentication in Apache WSS4J

Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to …

org.apache.ws.security:wss4j org.apache.wss4j:wss4j-ws-security-dom Maven

Oct 30, 2014